The CleanTalk WordPress plugin 'Login Security, FireWall, Malware removal by CleanTalk' contains a stored XSS vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, the page URL parameter is not properly sanitized or escaped, enabling unauthenticated attackers to inject malicious scripts that persist and execute in the context of users visiting the affected pages. This vulnerability affects all plugin versions up to 2.168 and has a CVSS 3.1 base score of 7.2, indicating a high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of users visiting the injected page URL. This can lead to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality and integrity. There is no impact on availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — no official fix or patch links are provided. Users should monitor the vendor advisory for updates and apply any official patches once available. Until then, consider restricting access to affected plugin features or implementing web application firewall rules to detect and block suspicious URL inputs related to this vulnerability.